Hole in PHP could give attacker server control
A security hole in the PHP (PHP: Hypertext Preprocessor) scripting language used on many Web servers could allow an attacker to execute code on affected systems or even take control of them, according to a security alert released Monday by The PHP Group.
The vulnerability affects PHP 4.2.0 and 4.2.1 and comes as a result of a flaw in the HTTP POST parser component of PHP. The HTTP POST parser is used to differentiate between files and variables sent by users to a Web server through Web forms, according to the alert. Insufficient checking in the parser could allow an attacker to crash the server, execute code or even take control of the system, The PHP Group said.
The hole can be exploited, locally or remotely, by anyone who can send HTTP POST requests to a server, the advisory said.
Different platforms may respond to attacks differently, however. PHP running on the IA-32 platform, more commonly-known as the x86 platform that includes such chips as the Pentium, does not experience the code execution issue, though attack on the vulnerability can still crash PHP or the Web server, according to the advisory.
A new version of PHP, 4.2.2, has been released to fix the problem. The new version of the software can be downloaded at http://www.php.net/downloads.php. The full security advisory is also available at http://www.php.net/release_4_2_2.php.
» posted by abennett
IDG News Service
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
Esther Schindler
If the comments are ugly, the code is ugly
claird
SVG a graphics format for 21st century
pasmith
Take Chrome OS for a test spin
Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?
jfruh
Android fragments vs. the iPhone monolith
mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.













